Elastic high stable eql

Potential SAP NetWeaver WebShell Creation

Identifies suspicious Java file creation in the IRJ directory of the SAP NetWeaver application. This may indicate an attempt to deploy a webshell.

View Source

Detection Logic

file where host.os.type in ("linux", "windows") and event.action == "creation" and
 file.extension : ("jsp", "java", "class") and
 file.path : ("/*/sap.com/*/servlet_jsp/irj/root/*",
              "/*/sap.com/*/servlet_jsp/irj/work/*",
              "?:\\*\\sap.com\\*\\servlet_jsp\\irj\\root\\*",
              "?:\\*\\sap.com\\*\\servlet_jsp\\irj\\work\\*")

Field Validations

Loading…

Comments (0)

Loading comments...